ci: modernize and harden container workflows

[mldangelo-oai]

Summary

• upgrade every container Buildx, build/push, GHCR login, and provenance action to an independently verified SHA-pinned Node 24 release
• share architecture-isolated GitHub Actions build caches while preventing pull-request builds from exporting trusted caches
• preserve production build records while suppressing disposable validation artifacts
• classify the expected hosted-runner Bubblewrap to Landlock fallback as a notice without weakening sandbox checks

Validation

• actionlint passes for both container workflows
• Prettier and git diff --check pass
• focused assertions verify immutable action pins, pull-request cache isolation, trusted release cache exports, validation artifact suppression, and preserved sandbox checks
• public ghcr.io/openai/codex-security:0.1.4 remains pullable and reports version 0.1.4
• production deployment settings separately verified with security-products required reviewers, self-review prevention, and administrator bypass disabled

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 2438fff86f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR modernizes the container CI and release GitHub Actions workflows by updating Docker/GitHub actions to newer SHA-pinned revisions, adding architecture-scoped Buildx cache usage with pull-request export isolation, and adjusting validation/release logging and artifact behavior to better match the intended security posture.

Changes:

• Upgrades Docker Buildx/build-push/login and provenance attestation actions to newer SHA-pinned versions.
• Adds architecture-isolated GHA Buildx caching, while preventing cache export on pull_request events.
• Suppresses disposable build record uploads during validation builds and downgrades the expected Bubblewrap→Landlock fallback message to a notice.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/container-release.yml	Updates action pins, adds arch-scoped Buildx cache config (with PR export isolation), suppresses validation build record uploads, and tweaks sandbox fallback annotation level.
.github/workflows/container-ci.yml	Updates action pins, adds GHA Buildx cache config (with PR export isolation), suppresses validation build record uploads, and tweaks sandbox fallback annotation level.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 2438fff86f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.